Skip to content

Instantly share code, notes, and snippets.

@DaanDeSmedt

DaanDeSmedt/es-elk-tcpdump-capture-host-traffic

Last active April 14, 2021 11:58
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save DaanDeSmedt/c068a7b03ac19045afe2f5c15158ef1b to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save DaanDeSmedt/c068a7b03ac19045afe2f5c15158ef1b to your computer and use it in GitHub Desktop.
Download ZIP
Capture host traffic for Elasticsearch instance using tcpdump
Raw
es-elk-tcpdump-capture-host-traffic
# dump to output
tcpdump -A -nn -s 0 'tcp dst port 9200 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i any
# dump to file
tcpdump -A -nn -s 0 'tcp dst port 9200 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i any -w tcpdump-es-traffic.txt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment